GigaWiper: Multi-Stage Destructive Windows Backdoor Combining Disk Wiping, File Encryption, and Boot Sabotage (CyberAv3ngers/Crucio/FlockWiper Lineage) — Threadlinqs Intelligence
As of 2026-07-10, GigaWiper: Multi-Stage Destructive Windows Backdoor Combining Disk Wiping, File Encryption, and Boot Sabotage (CyberAv3ngers/Crucio/FlockWiper Lineage) is a high-severity malware threat attributed to Iran-nexus actor (Crucio (Iran (assessed, not confirmed by Microsoft)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1167 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Iran-nexus actor (Crucio · Iran (assessed, not confirmed by Microsoft) · DESTRUCTION
GigaWiper is a Golang-based Windows backdoor first observed by Microsoft in October 2025 that consolidates a standalone raw-disk wiper, Crucio-derived fake-ransomware encryption (.candy extension, no
GigaWiper is a modular, Golang-compiled Windows backdoor that Microsoft Threat Intelligence disclosed on July 9, 2026, tracing destructive wiping incidents back to October 2025. Unlike single-purpose wipers, GigaWiper is architected as a full command-and-control implant with 20 distinct operator commands spanning destructive, reconnaissance, and surveillance categories, delivered over a RabbitMQ message broker (AMQP, fanout exchange "All" for broadcast and topic exchange "Topic" for targeted routing-key tasking) with results and output returned via Redis as a structured cmd.Result object (error, target_ip, task_id, computer_name, output, pwd, time, status, work_status).
The malware establishes persistence by using PowerShell to register a scheduled task named "OneDrive Update" that runs at both system startup and on a one-minute interval, masquerading as legitimate OneDrive telemetry. A registry value at HKCU\SOFTWARE\OneDrive\Environment tracks execution count to prevent redundant re-initialization.
Destructive capability is delivered through three related-but-distinct code paths that Microsoft assesses were authored by the same developer(s) and stitched together into GigaWiper:
1. Command 1 (WipeMain) performs physical-disk-level destruction: it enumerates physical drives via WMI (Win32_DiskDrive), identifies which drive hosts the Windows installation, strips partition references from the remaining drives via IOCTL_DISK_CREATE_DISK (DeviceIoControl), overwrites raw disk content in 10MB (0xA00000-byte) chunks with a crypto/rand-randomized first byte followed by zero-fill, and forces an immediate, zero-delay reboot.
2. Command 12 (WipeCMain) is a reimplementation of the standalone FlockWiper C tool (first seen on VirusTotal in June 2025, PDB path A:\GRAT\CWipeNew\Release\CWipeNew.pdb) — a multi-pass secure wipe of the Windows installation drive specifically, cycling through 0x00, 0xFF, and random byte patterns with pass-timing telemetry.
3. Command 3 (RanMain / BigBangExtortMain) is fake ransomware whose function name and logic Microsoft matched to the Crucio ransomware family documented in a December 2023 CISA advisory on IRGC-affiliated actors exploiting PLCs (the same lineage publicly tied to CyberAv3ngers water/energy-sector intrusions in the US, UK, and Ireland). It generates a random AES-CBC key/IV that is never persisted anywhere, encrypts files (excluding .exe/.dll), appends a .candy extension, deletes the plaintext originals, and drops a wallpaper image (image_danger.jpg) — producing ransomware-style victim messaging with zero possibility of recovery since no key exists to recover.
Command 2 triggers a BSOD via boot-file deletion; Command 19 wipes System, Setup, Application, Security, and ForwardedEvents Windows Event Logs via `wevutil clear-log`, falling back to direct deletion of C:\Windows\System32\winevt\Logs\Security.evtx if the utility call fails — clearing forensic evidence ahead of or during destructive operations.
Beyond destruction, GigaWiper functions as a full-featured espionage/RAT platform: Command 9 captures per-monitor screenshots; Command 10 records the screen opportunistically when the session is unlocked and the user has been active for more than 10 seconds; Command 20 opens a direct TCP listener providing VNC-like live remote desktop control (screen streaming plus keyboard/mouse injection), protected by a firewall rule deceptively named after the legitimate Windows component "Microsoft.Windows.CloudExperienceHost"; Command 7 executes arbitrary PowerShell with persistent working-directory state; Command 15 collects system information (IP, CPU, OS, and installed antivirus products enumerated via `Get-WmiObject -Namespace root\SecurityCenter2`); Commands 16-18 provide full process, service, and interactive registry management; Command 5 performs bulk AES-256-CBC file encryption/decryption with attacker-supplied keys (a legitimate-use variant of the ransomware primitive); Command 4 exfiltrates fil
Weaknesses (CWE)
CWE-506, CWE-311, CWE-778
Target sectors: critical infrastructure, water, energy, unspecified broad windows targeting per microsoft
Target regions: israel, united states of america, united kingdom, ireland
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1053, T1547, T1053, T1070, T1036, T1112, T1562, T1082, T1016, T1057